CVE-2018-17281

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.
Configurations

Configuration 1

cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
cpe:2.3:a:digium:asterisk:*:*:*:*:lts:*:*:*
cpe:2.3:a:digium:asterisk:*:*:*:*:standard:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert13:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert12:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert14:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert15:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21:cert2:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.21:cert1:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert1:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert2:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert3:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert4:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert5:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert6:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert7:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert8:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.13:cert9:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.8:cert2:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.8:cert3:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.8:cert4:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.8:cert1:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.1:cert4:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.1:cert5:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.1:cert6:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.1:cert7:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.1:cert8:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:13.1:cert3:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert16:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert17:*:*:lts:*:*:*
cpe:2.3:a:digium:certified_asterisk:11.6:cert18:*:*:lts:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Information

Published : 2018-09-24 10:29

Updated : 2019-10-03 12:03


NVD link : CVE-2018-17281

Mitre link : CVE-2018-17281

Products Affected
No products.
CWE